Lucene search

Gentoo FoundationGLSA-201208-06

HistoryAug 14, 2012 - 12:00 a.m.

libgdata: Man-in-the-Middle attack

2012-08-1400:00:00

Gentoo Foundation

security.gentoo.org

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.01 Low

EPSS

Percentile

83.5%

JSON

Background

libgdata is a GLib-based library for accessing online service APIs using the GData protocol.

Description

An error in the “_gdata_service_build_session()” function of gdata-service.c prevents libgdata from properly validating certificates.

Impact

A remote attacker could perform man-in-the-middle attacks to spoof arbitrary SSL servers via a crafted certificate.

Workaround

There is no known workaround at this time.

Resolution

All libgdata users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose "&gt;=dev-libs/libgdata-0.8.1-r2"

OSVersionArchitecturePackageVersionFilename
Gentooanyalldev-libs/libgdata< 0.8.1-r2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	dev-libs/libgdata	< 0.8.1-r2	UNKNOWN

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.01 Low

EPSS

Percentile

83.5%

JSON

Related for GLSA-201208-06